[PROJECT_NAME] Data Processing Agreement

Effective date: [DATE]

This Data Processing Agreement ("DPA") forms part of the agreement between [COMPANY_NAME] ("Processor", "we") and the customer using [PROJECT_NAME] ("Controller", "you") for the Service. It applies when we process personal data on your behalf.

1. Subject, duration, nature and purpose

  • Subject: personal data you or your users put into the Service.
  • Duration: for as long as we provide the Service to you, plus the deletion period in section 9.
  • Nature and purpose: hosting, storing, displaying and transmitting the data to provide the Service as described in the Terms of Service.
  • Types of data: names, contact details, identifiers, usage data and any other data you choose to submit.
  • Data subjects: your users, customers, staff and other people whose data you submit.

2. Instructions

We process personal data only on your documented instructions, which are the agreement, this DPA and your use of the Service's settings, unless the law requires otherwise. We will tell you if we think an instruction breaks data protection law.

3. Confidentiality

Everyone we authorise to process the data is bound by confidentiality.

4. Security

We take the technical and organisational measures required by GDPR Art. 32, including encryption in transit, access control and least privilege, logging, backups, and timely security updates. We review them regularly.

5. Sub-processors

You give us general authorisation to use sub-processors. Our current list is published at [WEBSITE_URL]. We will tell you at least 14 days before adding or replacing one, and you may object on reasonable data protection grounds. Each sub-processor is bound by data protection terms at least as protective as this DPA, and we remain responsible for them.

6. Helping you

Taking into account the nature of the processing, we help you to:

  • answer requests from data subjects to exercise their rights (GDPR Chapter III);
  • meet your obligations on security, breach notification, data protection impact assessments and prior consultation (Art. 32 to 36).

7. Personal data breaches

We will tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification duties.

8. International transfers

Where we transfer personal data out of the EEA, the UK or Switzerland, we use an adequacy decision or the European Commission's Standard Contractual Clauses (and the UK Addendum), which are incorporated into this DPA by reference.

9. Deletion and return

When the Service ends, we delete or return your personal data within [RETENTION_PERIOD], unless the law requires us to keep it.

10. Audits

We make available the information needed to show compliance with Art. 28 and allow for reasonable audits, with at least 30 days' notice, at most once a year unless there is a breach or an authority requires it.

11. California

Where the CCPA applies, we act as your service provider: we do not sell or share the personal information, and we do not retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing the Service.

12. Order of precedence

If this DPA conflicts with the agreement, this DPA prevails for the processing of personal data.

Contact

[COMPANY_NAME], [COMPANY_ADDRESS]. Data protection: [PRIVACY_EMAIL]. DPO: [DPO_CONTACT].